Truebit loses $26M to exploit as old DeFi protocols targeted

Integer overflow exploit drains 8,535 ETH (~$26M) and ~$300K TRU from unaudited Truebit 2021 contract

  • Truebit lost 8,535 Ether (about $26 million) and nearly $300,000 in TRU tokens to a Hacker on Thursday.
  • The exploited smart contract was deployed in 2021 and has no public record of a third-party audit.
  • DeFi hacks have continued into 2025, with over $2.5 billion stolen, according to data.
  • Security researchers say attackers are increasingly targeting older, lightly maintained protocols.
  • The breach used an integer overflow vulnerability, a known “maths problem” in smart contracts, as noted by security posts.

On Thursday at about 4pm London time, a hacker drained 8,535 Ether — roughly $26 million — from the reserves of Truebit by exploiting a bug in a smart contract deployed in 2021. The attacker then took just under $300,000 of the protocol’s TRU token. Truebit acknowledged the breach and, it said, “We are in contact with law enforcement and taking all available measures to address the situation.”

- Advertisement -

The compromised contract has no public record of a third-party audit, and the protocol moved to flag the incident soon after it occurred. The attack adds to a larger pattern of losses across crypto in 2025; data shows attackers stole more than $2.5 billion from projects this year.

Security researchers note Hackers are focusing on older DeFi protocols. Balancer lost $128 million in November from a contract live since 2021. Other legacy victims include vaults from Yearn Finance, projects from Rari Capital, and Ribbon Finance. Research commentary highlights that many of these contracts were written before current best practices were widespread and are no longer actively maintained. See a researcher’s discussion on the trend here and a developer post linking the trend to AI use by attackers here.

The Truebit breach used an integer overflow flaw — a numeric wraparound that lets attackers bypass checks and alter balances — a point noted in security posts explaining the vector. Integer overflows remain a recurring issue; for example, a July exploit on Cetus involved the same class of bug and led to about $220 million in losses.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.

- Advertisement -

Previous Articles:

- Advertisement -

Latest News

Bitcoin surges after Supreme Court limits Trump tariffs

The Supreme Court ruled that most of President Donald Trump's tariffs were imposed by...

Google Boosts Funding to Partners to Rival Nvidia

Google is boosting financial support to data-center partners to spur adoption of its AI...

Aave Dev Team BGD Labs Exits Amid DAO Conflict

BGD Labs, the key developer of Aave v3, is ending its service contract with...

Aave’s BGD Labs Ends 4-Year DAO Partnership

BGD Labs, a primary developer for the Aave protocol, announced it will end its...

AI Tool Cline CLI Hijacked in Supply Chain Attack

The AI-powered Cline CLI npm package was compromised, leading to an unauthorized update that...

Must Read

Are Cryptocurrency Securities?

TL;DR - Cryptocurrencies are not typically considered securities, as they are decentralized digital assets that operate independently of any central authority or government. However,...
🔥 #AD Get 20% OFF any new 12 month hosting plan from Hostinger. Click here!